Sigma detection rules, expert-reviewed

PowerShell PSAsyncShell Reverse Shell Activity via Script Block Logging

Detects PowerShell use of PSAsyncShell by matching the tool name in logged script block text.

Windows Registry: Modify User Shell Folders Startup Values for Persistence

Alerts on Windows Registry changes to User Shell Folders startup-related values that may be used to establish persistence.

Windows Process Creation: China Chopper Webshell Command Pattern via W3WP

Flags w3wp.exe-launched commands matching China Chopper webshell execution patterns in Windows process creation logs.

Atlassian Bitbucket Command Injection Attempt via Archive API Parameters (Webserver)

Alerts on Bitbucket REST archive query parameters containing a %00--exec execution marker.

Windows IIS connection string decryption via aspnet_regiis -pdf

Flags aspnet_regiis.exe runs that target IIS connectionStrings for decryption using -pdf.

PowerShell ScriptBlock Matching Invoke-Mimikatz Credential Dump Commands (Windows)

Detects PowerShell ScriptBlocks containing Mimikatz-like credential dump and certificate extraction command strings.

AnyDesk Windows: suspicious executable/DLL writes excluding gcapi.dll

Alerts when AnyDesk.exe or AnyDeskMSI.exe writes .dll/.exe files, excluding gcapi.dll.

Windows ImagingDevices.exe Spawns Unusual Parent/Child Processes

Alerts when ImagingDevices.exe participates in atypical process parent/child chains on Windows, based on process creation telemetry.

Windows: Unusual Child Process Spawn by dns.exe

Alerts when dns.exe launches an unexpected child process other than conhost.exe.

Windows dns.exe Deletes Files with Unexpected Targets

Alerts when dns.exe deletes any file other than dns.log on Windows.

Windows: Unusual File Modification by dns.exe

Alert on dns.exe changing files other than dns.log, which can indicate suspicious or compromised system activity.

Windows Remote Thread Creation via rundll32 Triggered by wab*, wabmig, or ImagingDevices

Alerts on remote thread creation targeting rundll32.exe from wab* or ImagingDevices.exe process images on Windows.

Windows: w32tm.exe Timer/Delay Usage via stripchart Parameters

Flags w32tm.exe executions using stripchart delay-related parameters that can support timed automation on Windows.

Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps

Flags renamed createdump.exe executions on Windows that use full dump flags and produce .dmp files.

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.